diff --git a/README.md b/README.md
index d09da19..b386d1e 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # DocuVault
 
-**Version 0.2.0 — Alpha**
+**Version 0.2.1 — Alpha**
 
 > **Not production-ready.** DocuVault is functional for local and self-hosted use but has not been audited or hardened for public internet exposure. APIs, environment variables, and the database schema may change without notice until a stable 1.0 release is declared.
 
diff --git a/backend/tests/test_migration_0006.py b/backend/tests/test_migration_0006.py
index dc654a5..1cb2751 100644
--- a/backend/tests/test_migration_0006.py
+++ b/backend/tests/test_migration_0006.py
@@ -279,9 +279,18 @@ class TestMigration0005To0006:
             "SELECT has_schema_privilege('docuvault_app', 'public', 'CREATE')"
         )
         row = cur.fetchone()
-        # If the user doesn't exist (integration DB doesn't have it), skip gracefully
+        # Role absence means the DB is misconfigured — fail explicitly rather than silently skipping
+        # the privilege-escalation gate. Set SKIP_ROLE_CHECK=1 to opt out intentionally.
         if row is None:
-            pytest.skip("docuvault_app role does not exist in the integration database")
+            import os
+            if os.environ.get("SKIP_ROLE_CHECK") == "1":
+                pytest.skip("docuvault_app role absent — SKIP_ROLE_CHECK=1 set")
+            else:
+                pytest.fail(
+                    "docuvault_app role does not exist in the integration database. "
+                    "The privilege boundary cannot be verified. "
+                    "Set SKIP_ROLE_CHECK=1 to skip intentionally."
+                )
         assert row[0] is False, (
             "docuvault_app must NOT have CREATE privilege on the public schema — "
             "only docuvault_migrate should be able to run DDL"
diff --git a/docker-compose.yml b/docker-compose.yml
index 5316ca8..d2710bf 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -256,7 +256,7 @@ services:
     volumes:
       - ./docker/loki/promtail-config.yaml:/etc/promtail/config.yaml
       - /var/lib/docker/containers:/var/lib/docker/containers:ro
-      - /var/run/docker.sock:/var/run/docker.sock
+      - /var/run/docker.sock:/var/run/docker.sock:ro
     command: -config.file=/etc/promtail/config.yaml
     depends_on:
       - loki
@@ -268,7 +268,7 @@ services:
     environment:
       - GF_AUTH_ANONYMOUS_ENABLED=false
       - GF_SECURITY_ADMIN_USER=${GRAFANA_ADMIN_USER:-admin}
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-changeme}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:?GRAFANA_ADMIN_PASSWORD must be set}
     volumes:
       - grafana_data:/var/lib/grafana
     depends_on: